Dealing With Insider Data Theft

To learn that your company's confidential data was stolen, not by any hacker, but by an employee, is a nightmare scenario that no one wants to face.

But it's also a risk that's very real. The recent arrest of a former NSA contractor suspected of stealing classified government files is just the latest high-profile example, and security experts say all companies need to be on guard against potential insider threats.

How serious is the threat?

It's not every day that thieving employees take to the digital black market to sell their company's sensitive information, but it does happen, and incidents have been occurring more frequently, said Andrei Barysevich, a director at security firm Flashpoint.

Flashpoint specializes in investigating marketplaces on the Dark Web for possible sales involving private company data. In one such case, it identified an employee of a major software company attempting to sell valuable source code for about $15,000.

Flashpoint has also detected other incidents of insiders trying to sell information from financial companies, healthcare providers and law firms, all of which hold valuable data such as bank account numbers, patient information and upcoming merger and acquisition deals.

In many of those cases, it appears the insider had access to sensitive data that no one at their companies bothered to monitor, Barysevich said. That's a serious problem, and he advises companies to segregate all valuable data away from employees who don't have a reason to use it. He also says they should create a culture where employees are aware of the insider threat.

Not all are malicious

Data protection company Bitglass has also been studying the insider threat. In a report published last month, it found that one-third of organizations surveyed had experienced an insider attack within the past year in which data was leaked.

However, malicious insiders weren't the only ones to blame. Careless employees caused some of the leaks. "Inadvertent leakage is also a big problem," said Salim Hafid, product manager for Bitglass. 

Cloud-based applications and bring-your-own-device policies have only made it easier to accidentally share or publish confidential data, he said. As a result, more corporate data is getting out of company networks and into personal smartphones and file-sharing systems.  

"A huge number of organizations that have cloud applications deployed have no means to identify these careless activities and no way to mitigate the threat," Hafid said. Companies like Bitglass sell services to fill those gaps.

Security vs. Privacy

To solve the problem, security firms are also coming up with products that can monitor access to a company's most sensitive files. The European company Balabit has created Blindspotter, which is designed to detect any unusual employee activity on corporate systems.

It does this by looking at where the employee is accessing the data, what applications are being opened and even mouse movement and keyboard strokes, said Balabit CTO Balázs Scheidler. The Blindspotter software can then score what activity looks suspicious and even react by terminating an employee's corporate connection.

"We get a very intimate insight into what you are doing," Scheilder said. "Traditional tools aren't capable of looking at this traffic."

That insight may not be to everyone's liking. With real-time monitoring can come concerns about violating employee privacy.

"It's important for the companies to be transparent and communicate to those who are being monitored why this is happening," Scheilder said. The monitoring doesn't have to involve all employees. It can focus on those with high-level access, such as system administrators, who could be the target of hackers or insider threats trying to steal their login credentials.  

"The kind of damage that can happen if your account is stolen ... can be communicated very clearly," he said.

Maintaining the right approach

Companies that do suspect an insider threat should contact the professionals, said Eric O'Neill, national security strategist for security firm Carbon Black.

"You shouldn't do it alone," he said. "You don't want to corrupt the investigation. These things can get touchy."

That can be especially true when malicious employees are trying to cover their tracks. Evidence needs to be found and preserved to help determine the full extent of what may have been stolen, O'Neill said.

It's also important not to go too far in catching insider threats. "Certain procedures can make employees feel like they are working in a police state," he said.

However, O'Neill encourages companies to take insider threats seriously. "Many companies and government agencies still have a blind spot with this problem," he said. "It's one of the most difficult issues facing security."

Computerworld

 

« Stolen NSA Hacking Tools For Sale In Bizarre Auction
Pentagon Creates New 5,000 Strong Cyber Force »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

DLA Piper

DLA Piper

DLA Piper is a global law firm with offices throughout the Americas, Asia Pacific, Europe and the Middle East. Practice areas include Cybersecurity.

ForgeRock

ForgeRock

ForgeRock, the leader in digital identity, delivers comprehensive Identity and Access Management solutions for consumers, employees and things to simply and safely access the connected world.

Netsparker

Netsparker

Netsparker provide a web application security scanner to automatically find security flaws in your websites, web applications and web services.

LRQA Nettitude

LRQA Nettitude

LRQA Nettitude is an award-winning global provider of cybersecurity services, bringing innovative thought leadership to the ever-evolving cybersecurity marketplace.

CalCom

CalCom

CalCom Hardening Solution (CHS) for Microsoft OMS is a security baseline-hardening solution designed to address the needs of IT operations and security teams.

Romanian Association for Electronic Industry & Software (ARIES)

Romanian Association for Electronic Industry & Software (ARIES)

ARIES is the Romanian Association for Electronic Industry and Software, the biggest and most influental organization created for the IT&C industry in Romania.

Adarma Security

Adarma Security

Adarma are specialists in threat management including SOC design, build & operation.

Pentest Limited

Pentest Limited

Pentest Limited provide information security consultation, penetration testing & red teaming services to companies across the globe.

Infinidat

Infinidat

Infinidat delivers enterprise-proven solutions for data storage, data protection, business continuity, and sovereign cloud storage.

BIG Cyber

BIG Cyber

BIG Cyber is a specialized Managed Security Service Provider (MSSP) dedicated to bringing military grade cyber security technology to the gaming industry.

R-Tech

R-Tech

R-Tech GmbH manages the digital start-up initiative, whose goal is to build a sustainable start-up culture in the field of digitization throughout the Upper Palatinate district of Bavaria.

Cisco Networking Academy

Cisco Networking Academy

Cisco Networking Academy is the world's largest classroom, bringing technology education, 21st-century skills, and improved jobs prospects since 1997.

Anxinsec

Anxinsec

Anxinsec Technology is a security solution and service provider with a focus on new technology and innovations in cybersecurity.

Global Market Innovators (GMI)

Global Market Innovators (GMI)

Global Market Innovators (GMI) delivers secure technology solutions to organizations in need.

Netox

Netox

Netox is a comprehensive IT service provider that combines IT support services, IT solutions and specialist services; specializing in cybersecurity solutions.

Boltonshield

Boltonshield

Boltonshield provide a unique and proactive approach to cyber defence with managed security services, integrated technologies, and a team of security experts, ethical hackers and analysts.